Create a variable with the values of a specific tag

[elenaperez]

I would like to create a variable that contains the values of a specific tag for the hosts. I'm trying to create the query to get these values.
Basically if the tag is called Business Application and the values are X, Y, Z I would like to get X, Y and Z.I tried with this but it gives me all the tags for the different hosts:

fetch dt.entity.host
| summarize count = count(), by:{tags}
| sort count desc
| fields tags

I guess you would need to parse the individual tags and separate them if they are key:value.
How could I create this query?

[sinisa_zubic · Accepted solution]

Hi @elenaperez 

to get a list of unique tag values for the tag "Business Application" this dql query should work for you

fetch dt.entity.host
| expand tags
| summarize tags = collectDistinct(tags)
| expand tags
| parse tags, """((LD:tag (!<<'\\' ':') LD:value)|LD:tag)"""
| fields tag = replaceString(tag,"""\:""", ":"), value = replaceString(value, """\:""", ":")
| filter toString(tag) == "Business Application"
| fields value

Best,
Sini

[elenaperez]

Thank you so much, it is exactly what I was looking for! Super helpful